CVE-2024-3032: 
NixOS vulnerability analysis and mitigation

The Themify Builder WordPress plugin before version 7.5.8 contains an Open Redirect vulnerability identified as CVE-2024-3032. The vulnerability was discovered and publicly published on May 23, 2024, by security researcher Valentin LOBSTEIN. The issue affects the plugin's login functionality where a parameter is not properly validated before redirecting users (WPScan).

The vulnerability is classified as an Open Redirect (CWE-601) with a CVSS v3.1 base score of 6.1 (Medium), having a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The issue stems from the plugin's failure to validate a parameter before redirecting users to its value. The vulnerability specifically involves the 'tb_redirect_fail' parameter in the login functionality (NVD).

When exploited, this vulnerability allows attackers to redirect users to arbitrary external websites. This can be particularly dangerous as it could be used in phishing attacks where users might be redirected to malicious websites while believing they are interacting with legitimate WordPress site functionality (WPScan).

A proof of concept exists demonstrating the vulnerability. The exploit involves sending a specially crafted request to the WordPress login page with a manipulated 'tb_redirect_fail' parameter. The attack can be executed remotely and requires user interaction (WPScan).

The vulnerability has been patched in version 7.5.8 of the Themify Builder plugin. Users are advised to update to this version or later to mitigate the risk. No alternative workarounds have been publicly documented (NVD).